Chapter Thirteen (b): Using Active Directory Integration

Transcription

1 Chapter Thirteen (b): Using Active Directory Integration Summary of Chapter: How to add a User to your Net/Cache/SecurePilot that will match your Active Directory Security Group. How to set-up your Net/Cache/SecurePilot to use Active Directory Integration on a Windows 2000/2003 Server. What you need: Knowledge of admin user account and valid password for your Pilot. Active Directory turned on, on your PC of Windows XP or higher Software Revision Required: Applicable to software revision > on Net/Cache/SecurePilots Please make sure that the date and time on the Active Directory Server and NetPilot are within 5 mins with each other, otherwise the below setup will not operate as desired! Using Active Directory integration: Select the Start button on the main screen of your Active Directory Server. Then select Programs, Administrative Tools and then Active Directory Users and Computers as highlighted below: You will be presented with a similar screen as below: Select your Active Directory Domain, as highlighted in the left column. Please take note of your Active Directory Domain as this is needed later to enter into the NetPilot. You will see a similar screen as shown left, double click the Users folder. (Highlighted in the right column). Adding a Security Group: The name of the Security Group entered below will be needed later for the User entered into the Net/Cache/SecurePilot. Once you have opened the Users folder you will see a similar screen as below. Right click on the Users folder in the left hand column as shown left. Then select New and Group. Version Four Chapter Thirteen Page 1 of 7

2 The New Object Group window will open, as shown below: Configuring a User: Enter a name for your Security Group, this will be needed later for the User you enter into your Net/Cache/SecurePilot. Select OK You can add more Security Groups by repeating this process, but these will also need to be added as Users on the Pilot (shown later) to allow the two to be matched. If users have already entered users please move on to Adding users to the Security Group section. Due to the limitations of Active Directory, do not use spaces when entering the user logon name and passwords below. Right click on the User folder again in the left hand column. Then select New and then User, as shown below: A New Object User window will open. The next screen is shown below: In the new window: Enter the relevant details of the user. When entering the user s logon name, make sure all the others are in similar format, so it is easier to remember, i.e. johnsmith@domain or jsmith@domain. When you have entered in all the details above select Next Enter a secure password (must contain a number, upper and lower case and must be more than 8 characters long). Select a tick box option. Select Next The next screen (shown on the right) will tell you all the details of the user you have just entered. If there is anything you want to change, select Back. If you are satisfied select Finish. To add more users, repeat the above process. Version Four Chapter Thirteen Page 2 of 7

3 Adding Users to the Security Group : You should now see the users and the Security Groups you have created in the list in the right-hand column. Right click one of the Security Groups and select Properties, as shown on the left. You will see this window open: Select the Members tab (highlighted left) You will see this screen below; select the Add button, as highlighted: In the new window select Advanced (Highlighted below) In the next window that opens (shown below), select the Find Now button, which is highlighted. Once you have selected this button search results will appear at the bottom. Find a user, as highlighted in the list and double click it. If you want to add more then one user, select the different Users from the list, so that they are highlighted and then select the OK button. Version Four Chapter Thirteen Page 3 of 7

4 The user s selected will show in the below window. To select more from here, select the Advanced... button again. Once you have finished, select OK and OK again. Repeat the above process to add the correct users into the different Security Groups you have created. I.e. Student users into the Security Group Students and Teachers into the Security Group Teachers. Adding a User: Log on to your Net/Cache/SecurePilot as shown in Chapter One (b). Select the User Account button on the left hand side, then the Users button at the top of the screen and then the Add button (all buttons are highlighted below). You will be presented with this screen shown below: The User name entered left must be the same as the Security Group in the Active Directory. This will allow the User to be mapped to the Security Group within the Active Directory. I.e. SecurityGroupStudents or SecurityGroupTeachers. This password isn t used for Active Directory. However, it is used on the fileshare of the unit; therefore it will need to be secure. Select the appropriate Group, from the list. The Group contains the Site Lists you assigned to it or created within Chapter 13(a). The Site Lists enclose the options to allow or block certain URLs. For more information on this please see Chapter 13(a). Select OK and OK again Version Four Chapter Thirteen Page 4 of 7

5 Setting up Active Directory on the Pilot: Select the Web button on the left hand-side of the screen, then the Advanced button at the top of the screen, and then the Active Directory link. (Both buttons and link are highlighted below). You will be presented with the Active Directory screen as shown below: Server Address : Enter your IP Address of your Active Directory Server Domain : Enter your Active Directory Domain (Which you noted down earlier) User and Password : Enter a User and Password that has the properties of an Administrator on the Active Directory Server. If you want to change the User name and Password, you must change this in the Active Directory first. The screen below has the default Administrator highlighted. You can change the details here, or create another user with admin rights. Select OK in the Active Directory screen. You will be presented with the below screen: Select the Next' button as highlighted left. Version Four Chapter Thirteen Page 5 of 7

6 You will see the screen below. You will be presented with the screen below: Select from the three options on the left, which device is going to do the authentication. Once you have chosen an option select the OK button. You may need to select authorised users for the web proxy service on your firewall. So select Next, as highlighted left. You will now be presented with two drop-down lists, as shown below: Select accept: url-filter, authorised users from the drop-down list of the Trust Group that you wish to use. Select OK and OK again to confirm the settings you have made. When the Users try and access the Internet they will not be asked for Username and Password. They will be authenticated from the log on details they entered at the beginning of their PC session. Five tips: To check that the connection of the Active Directory was successful or not. Select Logs on the left menu, and then the System button from the top of the screen. (Both buttons are highlighted below: If it was successful you will see something similar to this in the logs: Apr 21 11:24:32 winbind: winbindd shutdown succeeded Apr 21 11:24:32 kinit: Password for school.domain: Apr 21 11:24:32 winbind: Obtaining Kerberos ticket for school.domain: succeeded Apr 21 11:24:32 named[7886]: XX+/ /np web.example.com/A/IN Apr 21 11:24:32 net: [2006/04/21 11:24:32, 0] libads/ldap.c:ads_add_machine_acct(1405) Apr 21 11:24:32 net: ads_add_machine_acct: Host account for np web already exists - modifying old account Apr 21 11:24:33 named[7886]: XX+/ /NP WEB.example.com/A/IN Apr 21 11:24:33 net: Using short domain name -- school Apr 21 11:24:33 net: Joined 'NP WEB' to realm ' school.domain' Apr 21 11:24:33 winbind: Joining school.domain domain: succeeded Version Four Chapter Thirteen Page 6 of 7

7 If it wasn t successful you will see something similar to this in the logs: Apr 26 09:38:02 winbind: Obtaining Kerberos ticket for school.domain: failed Apr 26 09:38:17 net: [2006/04/26 09:38:17, 0] utils/net_ads.c:ads_startup(186) Apr 26 09:38:17 net: ads_connect: Interrupted system call Apr 26 09:38:17 winbind: Joining school.domain domain: failed If the connection is unsuccessful, please check the domain name and details entered are correct. To view your Net/Cache/SecurePilot in your Network Neighbourhood: Select the Maintenance button from the left-hand menu, then the Services button from the top of the screen and the WorkGroup link. (Both buttons and link are highlighted below) Enter the short-name of your Active Directory Domain in the text box provided. When the Net/Cache/SecurePilot is being used as a Proxy, the user will not be prompted for a Username and Password when accessing the Internet as this is automatically done in the background. If you have problems with the Active Directory/LDAP queries, please make sure that the clock on the Net/Cache/SecurePilot and the server is synchronised. If you need any help with this, the following link will tell you how to setup NTP on a windows 2003 unit If any changes are made to the Security Group or Users in Active Directory, please clear the cache on the Net/Cache/SecurePilot so these changes can be activated. Version Four Chapter Thirteen Page 7 of 7